# -*- shell-script -*-
#
#  Configuration file for ferm(1).
#

@def $INFRA01 = 172.16.2.9;

@def $HOST_DEBMIRROR = @resolve((ftp.nluug.nl ftp.nl.debian.org security.debian.org));
@def $HOST_DNS = 172.16.2.1;
@def $HOST_SMTP = @resolve(emailout.intra.cacert.org);

@def &CONTAINER($name, $host, $host_ext) = {
    table filter {
        chain FORWARD {
            daddr $host @subchain "$name-fwd-in" {
                jump global-in;
            }
            saddr $host @subchain "$name-fwd-out" {
                jump global-out;
            }
        }
    }
}

@def &CONTAINER_NAT($name, $host_ext, $host_int) = {
    &CONTAINER($name, $host_int, $host_ext);

    table nat {
        chain PREROUTING {
            daddr $host_ext DNAT to $host_int;
        }
        chain POSTROUTING {
            saddr $host_int SNAT to $host_ext;
        }
    }
}

@def &CONTAINER_IN($name, $proto, $port) = {
    table filter {
        chain "$name-fwd-in" {
            proto $proto dport $port ACCEPT;
        }
    }
}

@def &CONTAINER_OUT($name, $host, $proto, $port) = {
    table filter {
        chain "$name-fwd-out" {
            proto $proto daddr $host dport $port ACCEPT;
        }
    }
}

table filter {
    chain INPUT {
        policy DROP;

        # connection tracking
        mod state state INVALID DROP;

        # allow local packet
        interface lo ACCEPT;

        # respond to ping
        proto icmp ACCEPT; 

        jump global-in;

        mod state state (ESTABLISHED RELATED) ACCEPT;
    }
    
    chain OUTPUT {
        policy DROP;
        mod state state INVALID DROP;
        jump global-out;
        # connection tracking
        mod state state (ESTABLISHED RELATED) ACCEPT;
    }

    chain FORWARD {
        policy DROP;

        # connection tracking
        mod state state INVALID DROP;
    }

    chain global-out {
        proto udp daddr $HOST_DNS dport domain ACCEPT;
        proto tcp daddr $HOST_SMTP dport smtp ACCEPT;
        proto tcp daddr $HOST_DEBMIRROR dport http ACCEPT;
    }

    chain global-in {
        proto tcp dport ssh ACCEPT;
    }
}

@include 'ferm.d/';

table filter chain FORWARD mod state state (ESTABLISHED RELATED) ACCEPT;

# IPv6:
domain ip6 {
    table filter {
        chain INPUT {
            policy DROP;
        }
        chain FORWARD {
            policy DROP;
        }
        chain OUTPUT {
            policy DROP;
        }
    }
}